Skip to content

Reaper: The First Antivirus Was Written to Fight the First Virus

Abstract

The first computer antivirus program, “Reaper,” was written in 1971–1972 specifically to hunt and delete “Creeper”, widely considered the first computer worm. Creeper spread through ARPANET, displaying the message “I’m the creeper, catch me if you can!” Reaper spread through ARPANET in the same way, deleting Creeper when it found it. The cybersecurity arms race (malware and countermeasures locked in continuous mutual escalation) began before most people knew computers existed, in a government research network with a few dozen nodes and no commercial users.

Creeper: The First Worm

Creeper was written in 1971 by Bob Thomas at BBN Technologies, the same company that built the ARPANET Interface Message Processors. Creeper ran on DEC PDP-10 computers running the TENEX operating system and used ARPANET’s RSEXEC protocol to copy itself from machine to machine.

Thomas’s original Creeper did not replicate: it moved, deleting itself from one machine as it appeared on the next. Ray Tomlinson then wrote a variant that copied itself instead of moving, and that version is the one generally counted as the first computer worm.

Neither was malware. Creeper did nothing but display its message and travel, the machine operators were collaborators in the experiment, and there were no unintended effects. It was a demonstration of migrating software between machines, an early form of what would later be called mobile agents.

Reaper: The First Response

Reaper was written in 1972 by Ray Tomlinson, the same engineer who had built the self-replicating Creeper and who invented network email the year before. Reaper travelled the ARPANET the way Creeper did, looking for Creeper installations and deleting them.

Reaper was the first antivirus program in the sense of being the first software designed specifically to find and remove another piece of malicious (or at least unwanted) software. It worked.

The Pattern It Established

The Creeper/Reaper pair established the structural pattern of every subsequent malware/antivirus interaction:

  1. Malware exploits a system’s capabilities to spread and execute.
  2. Antivirus uses the same capabilities to identify and remove the malware.
  3. Malware authors adapt to evade the antivirus.
  4. Antivirus adapts to detect the new malware.

This cycle has been running continuously since 1971, with each generation more sophisticated and the stakes higher. The 1970s cycle involved two researchers at the same company on the same small network. The 2020s cycle involves nation-state threat actors, criminal ransomware syndicates, and AI-assisted detection systems.

The cybersecurity history and hacking history articles trace how the experimental curiosity of Creeper became the multi-billion-dollar criminal and national security problem of modern cybersecurity.

📚 Sources